Executive brief
@jmondi/url-to-png is a Node.js library that converts URLs to PNG images and stores them on disk. A path traversal vulnerability allows attackers to write PNG files to arbitrary locations on the server's filesystem by injecting directory traversal sequences (such as `../`) into query parameters, potentially overwriting system files or placing malicious content outside the intended storage directory.
Technical details
The vulnerability exists in the image ID construction logic (extract_query_params.ts), where user-supplied query parameters are concatenated into a filesystem path without proper sanitization. Specifically, the `configToString()` function converts request parameters directly into the imageId string, which is later joined with the storage path using `path.join()`. An attacker can inject path traversal sequences (e.g., `../../../../tmp/hack`) via any non-numeric parameter to write files outside the intended storage directory. The vulnerability requires network access and no authentication; exploitation results in arbitrary file write capability on the filesystem. A patch was released in version 2.1.2 that applies the `slugify()` function to sanitize all parameters before path construction.
Affected products
- Jason Raimondi @jmondi/url-to-png <2.1.2
Timeline
- 2024-07-15: disclosed
- 2024-07-15: patched: Fixed in version 2.1.2